L4XB 64e004a962 fix(hooks): keep the arguments after env -S whole ...

GNU env -S splits only its own argument; the ones after it reach the command unchanged. Joining them into the split string let a quoted ';' inside a later argument read as a command separator, so env -S 'echo' '; psql -c "drop table users"' was denied. Each later argument is now escaped back into a single literal word, which still leaves env -S 'psql -c' 'drop table users' denied.

2026-09-23 21:04:38 +02:00

..

auto-tmux-dev.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

bash-hook-dispatcher.js

fix(hooks): stop pre/post Bash dispatcher from echoing the input event (#2240)

2026-06-15 13:48:46 -04:00

block-no-verify.js

fix(hooks): block-no-verify handles stuck optional values and long-option prefixes (#3073)

2026-09-12 03:07:29 +01:00

check-console-log.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

check-hook-enabled.js

feat: deliver v1.8.0 harness reliability and parity updates

2026-03-04 14:48:06 -08:00

config-protection.js

fix(config-protection): match protected filenames case-insensitively (#2543)

2026-07-22 12:17:04 -04:00

cost-tracker.js

fix(metrics): bound incremental snapshot recovery

2026-09-13 04:55:52 +08:00

cursor-session-env.js

feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)

2026-06-07 13:27:00 +08:00

design-quality-check.js

feat: add web frontend rules and design quality hook

2026-04-02 17:33:17 -07:00

desktop-notify.js

fix: stability batch — hook stdin truncation, Codex exa TOML, Stop hook JSON, GateGuard repetition (#2227)

2026-06-11 00:31:33 -04:00

doc-file-warning.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

ecc-context-monitor.js

fix(hooks): context-monitor noise — loop-detection false positives + per-call cost-warning spam (#2486)

2026-08-10 22:33:10 -04:00

ecc-metrics-bridge.js

fix(metrics): bound incremental snapshot recovery

2026-09-13 04:55:52 +08:00

ecc-statusline.js

chore: update statusline ANSI color palette

2026-05-15 23:18:01 -04:00

evaluate-session.js

Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit

2026-02-18 07:40:12 +00:00

gateguard-fact-force.js

fix(hooks): keep the arguments after env -S whole

2026-09-23 21:04:38 +02:00

gateguard-heredoc.js

fix(gateguard): ignore heredoc prose for tee and path-qualified sinks (#2886)

2026-09-17 17:29:26 +00:00

governance-capture.js

fix: address PowerShell review bypasses

2026-09-05 16:12:58 -04:00

hook-input.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

insaits-security-monitor.py

test: cover hook bootstrap and InsAIts monitor

2026-04-29 17:45:22 -04:00

insaits-security-wrapper.js

fix: fail open on insaits monitor errors

2026-04-29 18:03:33 -04:00

lifecycle-hook-bootstrap.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

mcp-health-check.js

fix(security): stderr skip, independent audit, home MCP trust, dry-run conflict check

2026-09-15 00:29:23 +05:30

observe-runner.js

fix(hooks): require successful shell probe in observe runner (#2403)

2026-07-13 21:31:12 -04:00

plan-canvas-pending.js

fix(plan-canvas): deliver browser chat to the agent every time (#2739)

2026-08-09 18:15:25 -04:00

plan-canvas-sessions.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

plugin-hook-bootstrap.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

post-bash-build-complete.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-command-log.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-dispatcher.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-bash-pr-created.js

fix: consolidate bash hooks without fork storms

2026-04-14 21:23:57 -07:00

post-edit-accumulator.js

perf(hooks): batch format+typecheck at Stop instead of per Edit (#746)

2026-03-31 14:12:12 -07:00

post-edit-console-warn.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-format.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

post-edit-typecheck.js

fix(hooks): preserve complete bounded passthrough payloads

2026-09-07 16:26:10 -04:00

posttooluse-dispatcher.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

pre-bash-commit-quality.js

fix(hooks): support python style comments in pre-commit quality checks (#3194)

2026-09-21 14:33:19 -04:00

pre-bash-dev-server-block.js

fix(dev-server-block): stop blocking dev-<suffix> scripts (#2179)

2026-06-07 13:25:39 +08:00

pre-bash-dispatcher.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

pre-bash-git-push-reminder.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

pre-bash-tmux-reminder.js

fix(hooks): remove stray '?' that made every 'yarn <anything>' fire tmux reminder (#2517)

2026-07-20 16:21:03 -04:00

pre-compact.js

fix(hooks,lib): fix hook detection and parsing edge cases (#2405)

2026-07-28 21:32:42 -04:00

pre-write-doc-warn.js

fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358)

2026-06-29 15:54:55 -07:00

pretooluse-visible-output.js

fix: surface warn-only PreToolUse hooks (#2084)

2026-05-28 07:45:46 -04:00

quality-gate.js

refactor: deduplicate config lists and unify resolveFormatterBin branches

2026-03-11 10:45:28 +09:00

run-with-flags-shell.sh

fix(security): harden worker approval, hook traversal, MCP exec, install scripts, git hooks

2026-09-14 13:24:58 +05:30

run-with-flags.js

Merge pull request #3126 from VarunGore36/fix/reviewer-followups

2026-09-19 19:58:43 -04:00

session-activity-tracker.js

Merge pull request #1384 from KeWang0622/fix/lint-md028-eqeqeq

2026-04-12 23:03:19 -07:00

session-end-marker.js

fix: clean up observer sessions on lifecycle end

2026-04-02 18:02:29 -07:00

session-end.js

fix(session-start): scope summary lookup to repository identity (#3160) (#3168)

2026-09-19 02:08:50 -04:00

session-start-bootstrap.js

fix(hooks): keep silent hook paths silent (#2987)

2026-09-18 18:42:20 -04:00

session-start.js

fix(session-start): scope summary lookup to repository identity (#3160) (#3168)

2026-09-19 02:08:50 -04:00

skill-run-tracker.js

fix(skill-evolution): wire Skill PostToolUse tracker so skill-health shows real runs (#2490)

2026-08-12 18:12:49 -04:00

stop-format-typecheck.js

fix(hooks): never format installed plugin and marketplace clones (#2667)

2026-08-04 17:14:37 -04:00

suggest-compact.js

test: cover inferred-window hook output

2026-08-29 14:55:13 -04:00